Club Amiga de Montreal - CAM/CAM_CD_1.iso/files/198.lha/VirusX_v3.1/virusx.docs

Text File | 1988-12-28 | 15KB | 352 lines

                  -VirusX-

              by Steve Tibbett


   - The Complete Virus Removal System! -

VirusX - Fourth in a growing line of "X-Utilities".

REMEMBER: STUFF NEW TO THE LATEST VERSION IS AT THE _END_ OF THIS
FILE!

Version Notes:
--------------
Version Notes are now in the VirusX.C file, as is information on
some of the viruses.

Amiga Viruses have been following us around for some time now, and I
think it's about time we got rid of it for good.

There are a number of CLI-based Virus Checkers out there, which do their
job just fine, but if you're not into using CLI, what do you do? You use
VirusX!

Please, I encourage you to give this program to anybody who might have
the virus.  Including your local dealer - some of the dealers in this
area have the virus all over their disks, which they allow customers to
copy, and they don't do anything about it because they don't know how.
VirusX makes it extremely simple.

You can put VirusX in your Startup-Sequence.  When run, it will open a
small window so you know it's there (and it will display the occasional
message in it).  Whenever a disk is inserted into any of the 3.5"
drives, that disk is automagically checked for the SCA virus, and also
checked to see if it's boot sector is "Standard".  If the disk has a
nonstandard boot sector, it is either a new form of virus which I don't
know about yet, or it is a commercial program which uses the boot block
for  something constructive (like booting their game).

If VirusX finds a boot block it is suspicious about, it will present the
user with a requester either warning him that the disk has the SCA virus
(or any other current viruse), or telling him that the boot code is
nonstandard.  In either case, he is given the option to either ignore
it, or to Remove it.

If the user selects Remove, after he says he's SURE he wants to
rewrite the disk's boot sector (Remember: Never rewrite the boot
sector of a commercial program unless you KNOW that program doesn't
use it for something else.  If the program gives you the AmigaDOS
window before running, you know it is safe to repair that disk.).
The boot code written back to the disk by VirusX is the same boot code
that the AmigaDOS INSTALL command (and it's compatible counterpart on
one of the fish disks) uses.

If you click in the little "VirusX" window, and type a number from 0
to 3, (Corresponding to the drive # you would like to look at), VirusX
will resize it's window to fit in the ASCII text of these two blocks,
and allow you to view it.  When you run across a "Nonstandard Boot
Block", you can now check and see if the boot block is some sort of
new Virus (Assuming that the author of the Virus left a string in it)
as you will see something like "Revenge Virus 1.2G" or whatever string
that identifies the virus.  Note that not all viruses have text strings
in them, so don't use this method alone to determine whether an
unknown boot block is a virus or not.

Also, you can check to see which strain of the SCA virus you have
(VirusX will report "an SCA virus", but will not tell you if it is the
"LSD" virus, or the "Zorro/Willow" virus or whatever new ones may
appear).

Generally, if boot code is capable of writing itself back to a different
disk than the one it was loaded from, it is a virus.

Keystrokes:  0, 1, 2, 3, will show you the boot block of whatever drive
you select (0 would be DF0:, say), I will show you the Info window.
C will cause VirusX to  re-check all inserted
disks.  To use the keystrokes, click in the main VirusX window and type
away.

To move the initial position of the VirusX window, just put two numbers
after the "VirusX" line in your command line.  For instance, to put it
at 50,30, just say VIRUSX 50 30.

If you run across a strain of the virus, or any other virus that VirusX
doesn't specifically warn of, PLEASE send me a copy of a disk with that
virus on it!  I want to keep VirusX current, and to do so, I need the
viruses.

Of course, there are those of you who are thinking that I am some nut
case trying to spread my own virus hidden under the guise of a virus
checker.  Well, just for you, I've included the C source code.  Please,
if you don't trust me, don't discard a useful utility as untrustworthy
for no reason, CHECK THE SOURCE!  Recompile it if you think I'm trying
to slip a fast one on you.  I just want to see the virus out of all of
our lives.

I want feedback on this!  Send me a letter!  This program is
Copyrighted, but is freely redistributable (It's NOT Shareware).  Do
what you want with it, but  Please don't use it for evil purposes.
That's what I'm trying to prevent.  (If your conscience is compelling
you to send me something, send me an original game you're bored
with... It won't cost you anything, and it'll keep me busy for a
few hours (or more...).

My address:

    Steve Tibbett
    2710 Saratoga Pl. #1108
    Gloucester, Ontario
    K1T 1Z2

    My BBS: OMX BBS, 613-731-3419.

    I can be reached on BIX as "s.tibbett" and on People/Link
    as "SteveX".  I'm also on Compuserve, but with their dumb
    numbering system, I can never remember who I am.


---------------------------------------------------------------

BYTE BANDIT VIRUS:

What the Byte Bandit virus does is once it's in
memory, it copies itself to just above the high memory
pointer on the first hunk of RAM it can find (Which means
it's not always in the same place), wedges itself into the
Interrupt Server chain, into the Trackdisk.device's vectors,
and creates itself a Resident structure so it can hang
around after reboot.

It watches EVERY disk inserted, and will write itself to ANY
bootable disk that is inserted!  This one can spread like
wildfire - every disk you insert into your external drive during
a session with this Virus loaded will result in all those disks
being infected.  Ouch.

Also, if you Install a disk while this virus is going, it will  just
copy itself back to the disk - which is why it has to be wiped it from
memory.

When VirusX finds this virus on a disk, it will also display a "Copy
Count" which is the number of disks that have been infected by that
"Branch" on the "Tree" that the virus is on -  If you infect a disk with
your copy, and your copy is number 300, then that copy will be #301.  If
he infects somebody,  that will be #302, but on YOUR copy, two
infectations down the line, there will be another #302... Anyways, the
copy count on MY Byte Bandit virus is #879...

Note that VirusX will check RAM for this virus as well as the disk.
This was necessary as you can tell from the description above.

Special thanks must go here to Dave Hewett, who, 2 days after I gave him
a copy of the virus, gave me a printed, commented disassembly of the
virus with meaningful labels and everything I needed to stomp it -
Thanks Dave!

Thanks must also go to Bruce Dawson of CygnusSoft Software, who went to
the trouble of being the First person to send me this Virus.  (As of
yet, he's also the ONLY person - Geez, folks, I need YOUR help to do
this too, eh?)


REVENGE VIRUS:

What this virus does, is everything that the Byte Bandit virus does,
PLUS, after infecting a disk, it will wait one  minute after every
reboot, and change your mouse pointer  into an image of a certain part
of the Male anatomy. 8-)

I think the reason this virus is called the "Revenge" virus is because
it looks specifically for the Byte Bandit and for the SCA Virus.  If
it finds either of these, it Rigs THAT virus so that it will CRASH the
machine unless THIS virus is loaded first.  Note that I might be wrong
about this - that's the way it looks from the disassembly, but I don't
have an SCA virus here to  test it with.   I tried it with the Byte
Bandit, and it didn't seem to do anything like this - but be warned,
in case it pops up later or something.

He stays in RAM via changing the CoolCapture vector to point to his
own code.  He then intercepts the DoIO() call and watches for any
attempts to rewrite or to read the boot block and acts accordingly.
He also has an interrupt around counting VBlanks until it's time to
bring up his sicko pointer.

To get this virus out of memory is Simple - Hold down the Joystick
button (Plug a joystick into port 2, and hold down the button while
you are rebooting), and the screen will briefly turn RED during the
boot, and it's out of memory. (If you hold down Joystick button AND
mouse button, it will half-remove himself from RAM and turn the screen
Blue)

VirusX will alert you if the virus is present in RAM and will render
it helpless in RAM before telling you about  it.  It will also report
it's presence on disk.

I'd like to thank Lars Wilkund for being the first (And only so far)
person to send me this virus on disk.  Lasse is part of a Swedish users
group with over 700 members!

BYTE WARRIOR VIRUS:

The Byte Warrior Virus is a lot like the Byte Bandit virus, except
it is not designed to hurt anything - it will start an "Alarm"
sound if it sees another virus (or at least I think it does -
it hasn't for me), but other than that, it will write itself to
any disk inserted.  There is also a hidden message in it, asking us
to spread it around and not to erase it.  Ya, right.


NORTH STAR VIRUS:

It's a virus itself that alerts you to other ones -
I think this sort of idea is stupid because it can do just as
much damage as the rest of them.

One new virus showed up for this version, the "Obelisk Softworks
Crew" virus.  It was sent to me by Jason Allen Smith.  Thanks,
Jason!

Other changes this version - it's now a bunch smaller (again!) thanks
to a bit of a rewrite in assembler, and some reorganization.


SCA Virus:

This is the original.  It just sits in RAM writing itself to any
disk you boot off of.  You can get it out of memory by either running
VirusX, or holding down the left mouse button while you reboot
the machine (The machine will flash the screen green once it's
truly gone).

-------------------------------------------------------------------

The IRQ Virus:
--------------

The IRQ Virus is the latest Amiga Virus (that I've seen anyway).  This
one stands out from the crowd, in that it is NOT found in the boot
block.

This Virus attaches itself to executable programs.  It's prime target
is the C:DIR command, but it will also look at your startup sequence
and attach itself to the first executable program found in the startup
sequence.

A sample chain of events:

   - You download or otherwise acquire a new program.  This program
     happens to be infected.
   - You execute this program.
   - The Virus then attaches itself to memory (by taking over the
     OldOpenLibrary() vector), and adds a KickTagPtr (for no apparent
     reason).
   - Now, you're on DF0: and you run a program that uses the
     OldOpenLibrary() vector (hard to predict which ones do...),
     the Virus will open your startup sequence and picks the first
     filename it sees in it, see if it's executable, and if so, it
     will write itself into that file.  IF it's not executable, it
     will try and write to the DIR command on that disk.

As you can see, the only files this virus will infect, will be whatever
comes first in your startup sequence, and the DIR command.  The only way
this Virus could possibly spread via modem is through deliberate sabotage,
(unless the guy actually DID have the program as the first thing in his
startup sequence before sending it to you).


WHAT IT DOES

This Virus is mostly a harmless joke.  It will not kill commercial programs
(at least not any I've seen so far), it doesn't attack anything,
doesn't do anything malicious.  It's not nice to have around, but it's
certainly better than a malicious virus!

It changes the title bar of the Initial CLI window when you boot, and it
will try to write to any disk inserted - thus bringing up the "Volume
whatever is write protected" requester whenever you insert a write
protected disk.

It will write itself to any disk you execute a file off of, possibly to the
DIR command, possibly to the first thing in the startup sequence,
depending on the startup sequence.

This virus will not work under Kickstart 1.3 - you will get Software
Error requesters whenever you run an infected program.  I'm not sure
why, but this is probably good.


HOW TO KNOW IF YOU HAVE THIS VIRUS

You cannot identify a file that has this virus in it just by looking at it.
The virus encrypts the text parts of itself, and encrypts it differently on
each copy - so you can't learn to recognize it.

You can tell your system is infected if you put in a write protected
workbench disk (or any disk that has a startup sequence), and if the system
brings up a "Volume whatever is write protected" requester, then this virus
is in RAM attempting to infect this disk.

Running VirusX 3.1 will tell you that this virus is in RAM, and VirusX will
remove it from RAM.

The other thing this Virus does is, when it first installs itself in your
system upon reboot, it changes the title bar of the current window,
(usually the initial CLI window, since it IS the first thing in your startup
sequence), to say something like "AmigaDOS Presents:  The IRQ Virus,
V41.0".  This is of course a dead giveaway.


HOW TO GET RID OF THIS VIRUS

To get the virus out of RAM, run VirusX 3.1 and it will tell you if it
found it and that it removed it if it did.  VirusX will check disks the
same way that the Virus does - it will look at the startup sequence,
determine if the first file found (or the DIR command) are infected, and
give you the option of repairing them if they are infected.

You can also get rid of this virus simply by deleting all infected programs
and rebooting.  This virus will not hang around after a reboot.

Because this virus can hit a number of files, not all of which VirusX will
find, also included is a small program by Dan James called KV, "KillVirus".
This program will check a whole directory's worth of files for this
specific virus.

VirusX 3.0 will look in the same places the Virus does for possibly
infected programs.  If it finds one, it will pop up a window and show
you where it found it, and ask if it's OK to remove it.


HOW TO MAKE SURE YOU DON'T GET THIS VIRUS

Keep VirusX 3.1 running when you test new programs.  VirusX will alert you
as soon as it sees this virus appear in memory - probably the last program
you ran is infected if VirusX reports it found the virus.

===========================================================================

I'd like to thank Lasse Wilklund, Jason Allen Smith, Bruce Dawson,
Robb Walton (sorry, Rob, I can't remember how your last name goes,
I think that's it), Pete Foley, and all the others who have sent me disks
whom I cannot remember.  Sorry I don't answer mail as quickly or
as often as I'd like, I have very little time these days.
Mucho thanks also to Dan James, who's been helping me all along,
and who did a lot of the finding out about the IRQ Virus.

There are MORE viruses out there!  Please, send them to me!

    ...Steve